E-commerce merchants lost $115.32 billion to online payment fraud in 2024 (Juniper Research). Cumulative losses between 2023 and 2028 are projected to reach $362 billion. And those are just the direct losses. When you factor in chargebacks, manual review costs, false declines, and lost customers, every $1 of fraud costs US e-commerce merchants $4.61 (LexisNexis True Cost of Fraud, 2025). That is a 32% increase from $3.16 in 2022.

Meanwhile, the fraud that businesses successfully prevent creates its own damage. False declines, where legitimate transactions are rejected by overly cautious fraud filters, cost US merchants an estimated $118 billion annually. That is more than 10 times the value of actual card fraud losses. 56% of US consumers reported experiencing a false decline in the past three months of 2024.

This article breaks down how online payment fraud actually works, which types are growing fastest, what they cost, which industries are hit hardest, and how to build a fraud prevention strategy that catches real fraud without blocking real customers. It also covers how Juspay Hyperswitch helps merchants implement multi-layered fraud defense, including its FRM (Fraud Risk Management) architecture, 3DS Intelligence Engine, and integration with 300+ processors and payment methods.

The Scale of Payment Fraud in 2024-2025

Global Card Fraud

Global card fraud losses hit $33.83 billion in 2023 and $33.41 billion in 2024, a slight 1.2% decline (Nilson Report). Cumulative card fraud losses from 2023 to 2032 are projected at $403.88 billion. The projected peak is $41.06 billion by 2030.

The US bears a disproportionate share: it accounts for 26.31% of global card volume but 41.87% of global card fraud losses. American businesses lost 9.8% of revenue to fraud in 2025, a 46% increase from the prior year (TransUnion, 2025).

Fraud Reported to Federal Agencies

Sources: FTC, 2025, FBI IC3, 2025

76% of US organizations experienced attempted or actual fraud in 2025. The FBI IC3 received over 1 million complaints for the first time in 2025.

The True Cost Multiplier

The direct fraud loss is only the beginning. For every dollar of fraud, merchants absorb multiple layers of cost:

Source: LexisNexis True Cost of Fraud, 2025

These multipliers include the lost merchandise, chargeback fees ($20 to $100+ per dispute), payment processor penalties, manual review labor, customer acquisition costs for lost customers, and increased processing rates from card networks.

Types of Online Payment Fraud: What Is Growing and How Fast

Card-Not-Present (CNP) Fraud

Card-Not-Present fraud occurs when a stolen card number is used for an online transaction where the physical card is not required. CNP fraud made up 73% of all credit card fraud in the US in 2024, up from 57% in 2019 (FICO). US CNP fraud losses reached approximately $10 billion in 2024, up from $9.5 billion in 2023, and are projected to cost US banks $12 billion in 2025. Globally, CNP fraud losses are estimated to reach $49 billion by 2030.

The growth is structural. As commerce moves online, every new e-commerce checkout, subscription service, and digital wallet creates another attack surface for stolen credentials.

Account Takeover (ATO)

Account takeover fraud occurs when a fraudster gains unauthorized access to a legitimate user's account, typically through credential stuffing, phishing, or SIM swapping, and then initiates unauthorized transactions. ATO losses are projected at $17 billion in 2025, up from $13 billion in 2024, a 31% increase (AuthX, 2025). 29% of US adults (approximately 77 million people) experienced an ATO in 2024. ATO attacks increased 24% year-over-year, with 83% of organizations experiencing at least one incident. ATO in commercial banking rose 36% in 2024 and has surpassed ransomware as the top enterprise security concern.

Friendly Fraud / First-Party Fraud

Friendly fraud occurs when a legitimate cardholder makes a purchase and then disputes the charge with their bank, either intentionally (to get goods for free) or due to confusion about the transaction. First-party fraud represented 36% of all reported fraud in 2024, up from 15% in 2023. Visa estimates that friendly fraud accounts for up to 75% of all chargebacks (Chargeflow, 2025). 72% of merchants reported increased friendly fraud in 2024, with a 40% increase predicted by 2026. The root cause is behavioral: 84% of consumers find filing a chargeback simpler than contacting the merchant for a refund.

Synthetic Identity Fraud

Synthetic identity fraud combines real and fabricated identity elements (a real Social Security number with a fake name and address) to create a new "person" that can open accounts, build credit, and eventually "bust out" with large fraudulent charges. The Federal Reserve classifies it as the fastest-growing type of financial crime in the US. US lender exposure reached $3.3 billion at end of 2024, an all-time high (TransUnion). Broader estimates put US economic losses at $30 to $35 billion annually. Synthetic identity document fraud increased 311% between Q1 2024 and Q1 2025, driven by generative AI producing convincing fake identity documents.

Business Email Compromise (BEC)

BEC targets businesses by impersonating executives, vendors, or financial partners to trick employees into initiating fraudulent wire transfers or ACH payments. BEC generated $8.5 billion in losses reported to the FBI's IC3 between 2022 and 2024 (Nacha). 63% of organizations experienced BEC in the past year. BEC is cited as the most common threat vector by 70% of organizations.

Triangulation Fraud

In triangulation fraud, a fraudster sets up a legitimate-looking storefront, takes orders from real customers, then fulfills those orders using stolen card numbers on a real merchant's site. The real merchant ships the product, but the cardholder whose card was stolen files a chargeback. 26% of e-commerce retailers faced triangulation schemes in 2024, up 9 percentage points from 2023. Merchants lose an estimated $660 million to $1 billion monthly (Chargebacks911).

Refund and Return Fraud

Returns fraud and abuse accounted for 13.7% of all returns in 2023, amounting to over $100 billion in losses (Loop Returns). Refund and policy abuse became the most common e-commerce fraud type by 2024, impacting 48% of global merchants. Out of every $100 in returns, retailers lose about $5.90 to fraud.

Fraud by Payment Method

Mobile transactions (digital wallets, P2P, QR codes) account for 33% of fraud expenses in the US and 41% in Canada. 75% of worldwide digital payment fraud occurs on mobile devices. QR code payment scamming surged 51% year-over-year.

Sources: Digital Transactions, 2025, LexisNexis, 2025

Fraud by Industry: Who Gets Hit Hardest

Source: TransUnion H2 2025 Top Fraud Trends

Regional Fraud Patterns

Sources: Nilson Report, FICO European Fraud Map

The Chargeback Problem: $33.79 Billion in 2025

Chargebacks are the financial mechanism through which fraud costs hit merchants. Global chargeback volume reached 261 million in 2025, projected to hit 324 million by 2028. Global chargeback value stands at $33.79 billion, expected to reach $41.69 billion by 2028. US chargebacks alone are projected at 146 million in 2026, worth $15.3 billion.

Sources: Chargeflow, 2025, Chargeback.io, 2026

What a Chargeback Actually Costs

The headline chargeback fee ($20 to $100) is just the start. The total cost per dispute ranges from $315 for e-commerce to $450 for travel/hospitality. On a $100 physical product order, merchants lose $181 when fighting and losing a dispute (Mastercard, 2025).

Financial institutions spend $9.08 to $10.32 to process each dispute, and $5 to $10 million annually on chargeback staff per institution.

Merchant Win Rates

73.6% of disputes escalate to full chargebacks. AI-based dispute management solutions improve win rates by up to 80%.

The False Decline Problem: When Fraud Prevention Becomes the Enemy

False declines are legitimate transactions rejected by overly cautious fraud filters. They represent the hidden, often larger cost of aggressive fraud prevention.

Sources: NoFraud, Riskified

Merchants reject 6% of all e-commerce orders. Of those, 2% to 10% are actually legitimate purchases from real customers. The problem typically stems from rule-based fraud systems that apply rigid thresholds: block all orders over $500, flag all international transactions, decline any order where billing and shipping addresses differ. These rules catch fraud but also block legitimate customers who are traveling, sending gifts, or making unusual but genuine purchases.

The solution is not less fraud prevention but smarter fraud prevention: machine learning models that evaluate hundreds of signals in real time rather than applying binary rules.

Fraud Prevention Technologies: What Works

3D Secure 2 (3DS2)

3D Secure is an authentication protocol that adds a verification step during online card payments, confirming the cardholder's identity before the transaction completes. The latest version, 3DS2, has dramatically improved both security and user experience.

Fraud reduction:

Visa reports a 45% reduction in fraud on authenticated versus non-authenticated transactions, with a 9% lift in authorization approval rates. In Japan, where 3DS2 became mandatory in April 2025, dispute rates dropped 30%+, with 60% of transactions routed through the frictionless path at a 93% conversion rate.

Sources: GPayments, Orchestra Solutions

Conversion impact: 3DS1 caused 3% to 15% conversion drops. 3DS2 limits the impact to approximately 5% at most, often neutral or positive, by routing low-risk transactions through a frictionless flow (no customer interaction required) and only challenging high-risk transactions.

PSD2/SCA compliance: In the European Economic Area, PSD2 mandates Strong Customer Authentication (SCA) for electronic payments. 3DS2 is the primary compliance mechanism. Successful authentication shifts fraud chargeback liability from merchant to issuer. US 3DS adoption reached 58% of merchants in 2024, up from 31% in 2022. The 3DS authentication market is valued at $1.45 billion (2024), projected at $4.75 billion by 2034.

AI and Machine Learning in Fraud Detection

AI-driven fraud detection has moved from experimental to essential. 87% of global financial institutions deploy AI-driven fraud detection in 2025, up from 72% in early 2024. Over 60% of all fraud detection systems incorporate AI/ML (SAS/ACFE).

Source: All About AI, 2025

JPMorgan Chase achieves 98% detection accuracy and prevents $1.5 billion in annual fraud losses. One fintech deployment reduced false positives from 8% to 0.2%, and reduced average review time from 8 minutes to 45 seconds.

Tokenization

Tokenization replaces sensitive card data with non-sensitive tokens, eliminating the storage and transmission of real card numbers. 85% of online merchants now use tokenization (up from 78% in 2023). Visa reported a 44% surge in tokenized transactions year-over-year, with a 6% improvement in approvals and 30% reduction in fraud (CoinLaw, 2025).

Biometric Authentication

Biometric payment transaction value is projected to reach $1.2 trillion by 2028, a 113.6% increase from 2024 (Juniper Research). Over 50% of consumers use biometric authentication regularly. Biometric adoption has reduced fraud by 15%.

The AI Arms Race: Defense Versus Attack

AI is simultaneously the best defense against fraud and the most powerful weapon for fraudsters.

AI as Defense

• 92% to 98% detection accuracy
• Real-time interception in milliseconds
• 40% to 89% fewer false positives
• $25.5 billion in fraud prevented globally in 2025

AI as Weapon

Source: BioCatch, 2024

Human accuracy at detecting deepfakes is only 24.5%. Fraud detection models degrade in effectiveness every 6 months without retraining. This arms race means fraud prevention cannot be static. Defenses must incorporate the same AI capabilities that attackers use, and models must be continuously retrained on new attack patterns.

Building a Multi-Layered Fraud Prevention Strategy

No single technology stops all fraud. Effective fraud prevention requires layered defenses that work together across the transaction lifecycle.

Layer 1: Pre-Transaction Screening

• Device fingerprinting: Identify returning devices, detect emulators and VPNs
• Behavioral analytics: Analyze typing patterns, mouse movements, navigation behavior. Organizations using proactive monitoring cut fraud losses by 54%.
• IP intelligence: Flag known fraud-associated IPs, proxy/VPN detection
• Velocity checks: Detect abnormal transaction frequency from single users, devices, or IPs

Layer 2: Transaction Authentication

• 3D Secure 2: Risk-based authentication that adds friction only when needed
• Address Verification Service (AVS): Match billing address against card issuer records
• CVV/CVC verification: Confirm card-present knowledge for CNP transactions
• Biometric verification: Fingerprint, facial recognition, or voice for high-risk transactions

Layer 3: Real-Time Decision Engine

• Machine learning scoring: Evaluate hundreds of signals per transaction in milliseconds
• Network intelligence: Cross-reference against known fraud patterns across the processor network
• Custom rules: Business-specific rules layered on top of ML models
• Dynamic friction: Increase authentication requirements proportional to risk score

Layer 4: Post-Transaction Protection

• Chargeback alerts: Ethoca alerts have prevented 110 million chargebacks since 2011. Combined CDRN/RDR achieve 55% dispute reduction.
• Transaction monitoring: Flag suspicious patterns across customer accounts
• Refund analysis: Detect serial returners and policy abuse patterns
• Dispute management: AI-powered response with automated evidence compilation

How Juspay Hyperswitch Defends Against Payment Fraud

Juspay Hyperswitch is an open-source payment orchestration platform that integrates fraud prevention directly into the payment routing layer. Rather than treating fraud tools as external add-ons, Juspay Hyperswitch embeds fraud risk management, 3DS authentication, blocklisting, network tokenization, and revenue recovery into the payment state machine itself. This gives merchants unified fraud defense across 300+ processors and payment methods through a single integration.

Fraud Risk Management (FRM) Architecture

Juspay Hyperswitch has a dedicated Fraud Risk Management system built as a specialized connector category within the platform. It integrates with external fraud detection providers to deliver risk assessments that directly influence payment decisions.

Supported FRM providers:

• Signifyd: Guaranteed fraud protection with chargeback coverage. Signifyd evaluates transactions using its Commerce Network of billions of transactions and returns a risk score with a guarantee decision
• Riskified: Machine learning-based fraud decisioning with chargeback guarantee. Riskified analyzes device, behavioral, and transactional signals to approve or decline
• Cybersource Decision Manager: Rule-based and ML fraud management that leverages Visa's global network intelligence and authorization data for risk scoring

How FRM works in the payment lifecycle:

Juspay Hyperswitch executes fraud checks at five distinct points during the payment journey, creating a closed loop between fraud assessment and payment outcome:

Based on the FRM provider's response, Juspay Hyperswitch takes automatic action:

• Approved: Payment proceeds to the processor
• Rejected (Fraud): Payment is blocked and voided, no authorization attempted
• Manual Review: Payment paused, queued for merchant review in the dashboard
• Pending: Awaiting async decision via webhook from the FRM provider

This architecture means every transaction passes through the same fraud evaluation regardless of which processor ultimately handles it. Switching processors or adding new ones does not require re-integrating fraud tools.

3DS Intelligence Engine

Juspay Hyperswitch includes a 3DS Intelligence Engine that determines the optimal authentication path for every card transaction. Instead of applying 3DS uniformly (which hurts conversion) or skipping it entirely (which increases fraud), the engine makes per-transaction decisions based on historical data and configurable rules.

How the engine decides:

The engine analyzes authentication results, authorization outcomes, fraud signals, and chargeback history to classify each transaction into one of three paths:

1. Request 3DS challenge: High-risk transactions where authentication reduces fraud and shifts liability
2. Request acquirer exemption: Low-risk transactions in PSD2/SCA markets where exemption approval is likely and avoids unnecessary friction
3. Skip 3DS: Transactions outside SCA mandates where historical data shows low fraud risk

22 configurable parameters let merchants define custom decisioning rules:

• Payment attributes: amount, currency, recurring vs. one-time
• Card attributes: BIN range, card network (Visa, Mastercard, Amex), issuing country
• Customer attributes: device type, IP geolocation, customer history
• Transaction attributes: merchant category code, channel (web, mobile, in-app)

ML-based optimization: The engine continuously trains on authentication and authorization outcomes. If a particular BIN range shows high frictionless approval rates, the engine automatically routes more transactions from that range to the frictionless path.

3DS provider agnostic: Works with Netcetera, 3dsecure.io, GPayments, and Juspay's own 3DS Server. Merchants can switch providers without changing their integration or reconfiguring rules.

Native 3DS 2.0 implementation:

• In-line 3DS challenge for web with no page redirections
• Native SDK authentication on mobile with no web-views
• Frictionless flow for low-risk transactions (no customer interaction)
• Authentication analytics dashboard showing approval rates, challenge rates, and top failure reasons by issuer, BIN, and country

Fraud Blocklist

Juspay Hyperswitch provides a rule-based blocklist that lets merchants proactively block transactions matching known fraud patterns before they reach the FRM provider or processor. Blocklist rules are evaluated at the start of the payment flow, making them the fastest fraud prevention layer.

Blocklist types:

Blocklist entries are managed via API, enabling automated blocklist updates from internal fraud analysis or third-party threat intelligence feeds. When a fraud analyst identifies a compromised BIN range, they can add it to the blocklist via a single API call, and all subsequent transactions from that range are declined instantly.

The blocklist operates independently of the FRM provider, meaning it catches known bad actors even if the FRM provider's model has not yet learned the pattern. This is particularly valuable during fast-moving fraud attacks where hours matter.

Network Tokenization

Juspay Hyperswitch replaces raw card numbers with network-level tokens issued by Visa, Mastercard, and American Express. Unlike proprietary gateway tokens (which are locked to a single processor), network tokens are recognized across the entire card network and provide measurable fraud and authorization benefits.

How network tokenization reduces fraud:

Network tokens are domain-restricted, meaning a token issued for one merchant cannot be used at another. If a token is intercepted or leaked, it is useless outside the merchant's domain. This eliminates the primary attack vector in card-not-present fraud: stolen card numbers being reused across merchants.

Measured impact:

• 26% reduction in fraud on tokenized transactions compared to raw card transactions
• 3% to 5% improvement in authorization rates, because issuers trust network-authenticated tokens more than raw card numbers
• Automatic card updates: When a cardholder's card is reissued (new expiry, new number), the network token updates automatically. This eliminates the failed recurring payments caused by expired cards

Juspay has issued over 150 million network tokens across its platform, acting as both a Token Requestor (TR) and Token Service Provider (TSP) for Visa, Mastercard, and American Express. This dual role means Juspay Hyperswitch can issue tokens directly rather than routing through a third-party tokenization service, reducing latency and cost.

Network tokenization is processor-agnostic within Juspay Hyperswitch. A token created for a transaction routed through one processor works identically if the same card is later routed through a different processor.

Security Infrastructure

Juspay Hyperswitch provides the security foundation that fraud prevention requires:

• PCI DSS 4.0 and ISO 27001:2022 certified: Meets the highest industry security standards for handling card data
• Secure card vault with multi-layered encryption: SSL/TLS in transit, AES-256 at rest, merchant-specific Data Encryption Keys (DEKs) managed through a dedicated Key Manager Service
• Sensitive data masking in all application logs using Rust's type system (Secret<T> wrapper ensures card numbers and tokens never appear in logs)
• Database encryption at rest for all cloud-hosted environments

Frequently Asked Questions

What is the most common type of online payment fraud? Card-Not-Present (CNP) fraud is the dominant form, accounting for 73% of all credit card fraud in the US in 2024. CNP fraud losses reached approximately $10 billion in the US alone and are projected to hit $49 billion globally by 2030. It occurs when stolen card numbers are used for online transactions where the physical card is not required.

How much does payment fraud actually cost merchants? Every $1 of fraud costs US e-commerce merchants $4.61 in total losses (LexisNexis, 2025), including the lost merchandise, chargeback fees, processor penalties, manual review labor, and customer acquisition costs. For financial institutions, the multiplier is $5.00 per $1 of fraud. E-commerce merchants collectively lost $115.32 billion to online payment fraud in 2024.

What is the difference between 3DS1 and 3DS2? 3DS1 required customers to leave the checkout page for authentication, causing 3% to 15% conversion drops. 3DS2 supports a frictionless flow where the issuer authenticates the cardholder in the background without any customer interaction. 3DS2 reduces fraud rates from approximately 0.29% (no 3DS) to approximately 0.05%, while limiting conversion impact to approximately 5% or less. It also shifts fraud chargeback liability from merchant to issuer.

What are false declines and why do they matter? False declines are legitimate transactions incorrectly rejected by fraud prevention systems. US merchants lose an estimated $118 billion annually to false declines, more than 10 times the value of actual card fraud losses. 40% of shoppers who experience a false decline do not return. The solution is AI/ML-based fraud detection (92% to 98% accuracy) instead of rigid rule-based systems (65% to 70% accuracy).

How does AI help prevent payment fraud? 87% of global financial institutions deploy AI-driven fraud detection in 2025. AI systems achieve 92% to 98% detection accuracy compared to 65% to 70% for rule-based systems, reduce false positives by 40% to 89%, and intercept fraudulent transactions in milliseconds. Globally, AI prevented $25.5 billion in fraud in 2025. However, AI also powers fraud: deepfake fraud attempts increased 3,000%, making continuous model retraining essential.

Key Takeaways

Online payment fraud is a $115+ billion annual problem that is growing, not shrinking. The true cost to merchants is 4.6 times the face value of every fraudulent transaction. And aggressive prevention creates its own $118 billion problem in false declines.

The winning strategy is precision: catching real fraud while approving real customers. That requires layered defenses (3DS2, AI/ML scoring, tokenization, behavioral analytics), real-time decision-making, and continuous model retraining to keep pace with AI-powered attacks.

Juspay Hyperswitch provides the unified infrastructure to implement consistent fraud defense across 300+ processors and payment methods. Its FRM architecture integrates with Signifyd, Riskified, and Cybersource Decision Manager at multiple points in the payment lifecycle. Its 3DS Intelligence Engine optimizes authentication decisions using ML and 22 configurable parameters. And its processor-agnostic design ensures fraud rules apply consistently regardless of routing.